Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing… (CVE-2026-103529)

The vulnerability in Thelia v2.6.0 arises because the ZIP upload function for module installation does not validate or sandbox embedded PHP code. Authenticated administrators can upload a module containing malicious PHP code in its install() method, which is executed upon installation. This leads to remote code execution under the web server's privileges, potentially allowing an attacker to fully compromise the server environment.

Successful exploitation allows an attacker with authenticated administrator access to execute arbitrary PHP code on the server with the privileges of the web server process. This can lead to full system compromise, data theft, or further attacks within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and avoid installing untrusted modules. Monitor official Thelia channels for updates or patches addressing this vulnerability.